---
title: "CVE-2026-58043: nodejs node vulnerability"
url: https://erroneo.us/security/cve/CVE-2026-58043/
description: "CVE-2026-58043 (nodejs node): A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-07-30
date_modified: 2026-08-04
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-58043"
kev: false
cvss: 7.5
epss: 0.00152
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-58043: nodejs node vulnerability

**Signal:** Normal patch cycle. No exploitation signal; fix it in your next routine update if you are affected. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.2% , percentile 4: FIRST’s model estimates a 0.2% chance of exploitation activity in the next 30 days, higher than 4% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs local access needed. Lower urgency for most teams unless an attacker could already run code on the machine.
- Editorial verdict: Patch this week. Node.js July 2026 Security Releases: HTTP/2 and 11 CVEs — Routine but real: upgrade every supported Node.js line this week, sooner if you terminate HTTP/2 in Node or rely on the Permission Model as a sandbox.

## What it is

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js main, 22.x, 24.x, and 26.x.

## Affected products (CVE record)

- nodejs node: 22.23.1 <= 22.23.1, 24.18.0 <= 24.18.0, 26.5.0 <= 26.5.0

## Severity

- hackerone CVSS 3.0: 7.5 `CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.15% probability of exploitation activity in the next 30 days; percentile 4.

## Sources

- [CVE.org record CVE-2026-58043](https://www.cve.org/CVERecord?id=CVE-2026-58043)
- [NVD entry CVE-2026-58043](https://nvd.nist.gov/vuln/detail/CVE-2026-58043)
- [nodejs.org](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)

---
Source page: https://erroneo.us/security/cve/CVE-2026-58043/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt